upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-03-12 13:44:53 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 14

Security Update: session fixation

Browse source 
Previous version is vulnerable to session fixation attack in some situations, guessing non-apache-module-php5 environment. Regeneration of session id should be done here.
This commit is contained in:
NARUKAWA Hiroki 2013-12-20 03:38:51 +09:00
parent f0da7b20c1
commit 068688063e
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/private/user/session.php
View file

@ -157,6 +157,7 @@ class Session implements Emitter, \OCP\IUserSession {
if($user !== false) {
if (!is_null($user)) {
if ($user->isEnabled()) {
session_regenerate_id(true);
$this->setUser($user);
$this->setLoginname($uid);
$this->manager->emit('\OC\User', 'postLogin', array($user, $password));